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PREFACE 


Almost from the start of the program, a succession of both technical 
and administrative problems has caused delays in the development of 
the main engines for the nation's space shuttle, the principal 
transportation system for both civilian and military operations in 
space in the 1980's. 

As the time approaches for determining the readiness of the space 
shuttle for its first manned orbital flight, scheduled for March 1979, 
the Subcommittee on Science, Technology, and Space of the U.S. Senate 
Committee on Commerce, Science, and Transportation has sought assurance 
that the engines will perform safely and reliably. While the Subcom- 
mittee recognizes that the National Aeronautics and Space Administra- 
tion conducts extensive reviews of the space shuttle program and, in 
addition, receives separate, continuous evaluations from NASA's Aero- 
space Safety Advisory Panel and specific ad hoc reviews by special 
groups, the Senate has called upon NASA to initiate on behalf of the 
Subcommittee an independent assessment of the engine system to be 
conducted by the National Research Council's Assembly of Engineering. 

In a letter to the NASA administrator, Robert A. Frosch, dated 
December 14, 1977, Senators Adlai E. Stevenson and Harrison L. Schmidt 
observed : 

Recognizing. . .that the main engine represents a major 
technology advance and... that the engine development 
continues to experience difficulties, we are concerned 
whether everything possible is being done to assure 
development of a safe and reliable engine system. ..We 
would ask the [National Research Council] committee to 
give particular attention to questions of safety of the 
main engine during both the orbital flight test and 
operational phases of the shuttle program. ..We ask that 
this independent review. . .be completed prior to the end 
of February 1978 so that it can be considered during 
the FY 1979 authorization hearings. 
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Accordingly, the National Research Council’s Assembly of 
Engineering organized the ad hoc Committee for the Review of the Space 
Shuttle Main Engine Development Program to conduct the study. 

The shuttle main engine requires high-speed and high-pressure 
turbopumps. Because this technology is relatively new, there are few 
experts with the relevant background and experience in such rocket 
propulsion systems. The members of the committee have broad competence 
and experience in dealing with such advanced systems. 

One such advance is the XLR-129, an experimental engine that was 
tested but never made fully operational. Its development led the com- 
mittee to draw upon the knowledge of Richard Mulready of Pratt & 

Whitney Aircraft, a Division of United Technologies Corporation, 
which designed and developed the XLR— 129 under Air Force sponsorship. 

Mr. Mulready assisted the committee as a special adviser. 

The committee met first January 30-31, 1978, and twice since, on 
February 16-17 and February 23-24, including a site visit to the 
Rocketdyne Division of the Rockwell International Corporation in 
California to witness the work in progress on the main engine. Clearly, 
the committee’s study has been conducted with great speed and intensity 
in order to meet the deadline set for it by the Senate Subcommittee. 

The committee is grateful for the cooperation and documentation 
provided by NASA and Rocketdyne to enable the members to become 
quickly familiar with the problems and prospects of the shuttle main 
engine program. Moreover, the committee acknowledges the assistance of 
members of earlier technical review groups who described the findings 
of their studies at its first meeting — in particular, H.E. Grier, 

EG&G Co., Chairman of NASA's Aerospace Safety Advisory Panel, and G. 
Elverum, TRW, Chairman of the Space Shuttle Main Engine Panel of the 
Space Shuttle Review Team, who are neither NASA nor contractor employees. 

Finally, the committee expresses its thanks to Alexander H. Flax, 
President of the Institute of Defense Analysis, who, although unable to 
participate fully as a member of the committee, attended the committee’s 
first meeting and participated in its initial deliberations. 
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INTRODUCTION AND SUMMARY 


The space shuttle, a hybrid of spacecraft and airplane engineering, 
is the nation's most significant undertaking in manned space 
flight since the Apollo program. The shuttle consists of a manned 
orbital vehicle, launched by three identical liquid-propellant main 
rocket engines and two strap-on solid-propellant motors, or boosters. 

The main engines are built into the vehicle. The solid-fuel boosters 
are to be jettisoned about 2 minutes after the launch, when the shuttle 
reaches an altitude of some 25 miles; the boosters are intended to be 
recovered and reused. When fully developed, the shuttle will be a 
reusable, versatile vehicle transporting people, materials, experiments, 
and objects such as communications satellites into orbit and returning 
to earth to land like a conventional airplane. Each operational 
shuttle is designed to make at least 55 round trips into space, 
returning to an airport strip. 

Flight tests of the shuttle orbiter, involving approach and 
landing without any of the rocket engines, have taken place after it 
was launched from a modified Boeing 747 aircraft. The next major 
milestone of the program is a manned orbital test flight. The commit- 
tee considers it appropriate and wholly consistent with all previous 
aircraft experience to have a test pilot aboard the machine on its 
first flight. This increases the operational flexibility and, thus, 
the likelihood of success for the first manned orbital flight. 

The successful operation of the shuttle is based on advances in 
the operational state-of-the-art of its main engine, particularly with 
respect to its reusability and to increased performance levels of its 
components in terms of power per pound. The development of such an 
operational engine requires a greater step forward in technology over 
the J-2 rocket, which was used in the two upper stages of the Saturn 
vehicle that launched the Apollo spacecraft to the moon, than the J-2 
did over its predecessor, the RL-10 engine. However, any risk 
involved in making such an advance is reduced by the knowledge and 
experience gained through the development of the USAF Rocket Propulsion 
Laboratory-Pratt & Whitney experimental XLR-129 engine and the sub- 


1 



2 


sequent NASA Marshall Space Flight Center-Pratt & Whitney turbo- 
machinery program that produced turbopumps for an engine of 350,000 
pounds of thrust. These two programs were experimental and, in fact, 
were not intended to reach the operational stage. Nevertheless, they 
clearly anticipate the successful development of the space shuttle main 
engine. 

Major developments of new flight vehicles have traditionally 
proceeded by stages, with provision made for alternative approaches 
along the way in the design and construction of components.* 

Customarily, the overall system is separated into clusters and sub- 
clusters representing different components and functioning assemblies. 
These are designed and tested separately under simulated operational 
conditions, then redesigned to correct any problems or malfunctions, 
and ultimately qualified first for peak performance and then long-term 
service. Often, when major innovations are required, more than one 
approach to a design is initiated in parallel and constructed and 
tested separately. Later, the best design, possibly with modifications, 
is chosen and the others are discarded. When component performances 
have been validated, entire assemblies are then tested for coordinated 
functions. Finally, the complete engine is put through a series of 
tests under full power to assess proof-of-flight capability. Such a 
step-by-step, conservative approach provides opportunities to test 
each piece under conditions that exceed the demands of operational 
performance. In this way, it becomes possible to anticipate unexpected 
events and to plan for contingencies that may arise in flight testing. 

This is clearly a careful, costly, and lengthy approach. NASA's 
past successes in major developments of flight vehicles have led the 
agency and its contractor for the shuttle development to rely more 
heavily on computer computations to reduce the need to evaluate new 
designs by testing and, consequently, to reduce the need for redesign 
work. Thus, unlike such previous programs as Apollo, the development 
strategy for the shuttle program, including its main engine develop- 
ment, has been described as "fully concurrent, success-oriented" — a 
strategy based on the assumption that each piece of development 
hardware and its subsequent verification test will succeed on the first 
attempt. For the most part, the development tests employ an engine 
configuration assumed to be the same as the operational hardware to be 
used for the manned orbital flights. Further, the parts are manufac- 
tured on production tooling. Such a strategy offers potential savings 
in costs by eliminating parallel and possibly redundant development and 
test hardware. 

It may be that this strategy already has saved time and money, 
inasmuch as the quantity of hardware and spare parts have been reduced 
significantly. However, if or when malfunctions occur during the 
testing of the operational engine, new hardware may need to be designed, 
constructed, and retrofitted, causing delays in the program. 


*See Appendix A for a detailed discussion. 
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Indeed, such an eventuality has befallen the shuttle main engine. 
As often happens in the course of developing a complex, high- 
performance system, NASA and Rocketdyne have encountered some techni- 
cal problems related mainly to the rotating machinery and the high- 
pressure turbopumps which have led to engine test malfunctions and 
delays of test sequences. At the time the committee conducted its 
study in February 1978, some of the problems were unresolved. Solutions 
have been proposed but are yet to be proved correct through testing. 

The co mmi ttee understands that NASA is considering conducting the 
first six manned orbital flights of the space shuttle at 100 percent 
power of the "rated power level" of the main engines. Later flights 
will require a thrust level that is 9 percent greater than rated power 
or "full power level" in order to launch the full shuttle payloads 
into orbit. The requirements for safety and reliability of the engine 
operating at full power place more stringent demands on the various 
components of the engine than when it operates at the lower, rated 
power, level. Thus, even after the engine is qualified for the first 
manned orbital flight, additional development may be necessary to 
qualify the engine at full power. The development plan under 
consideration calls for the certification of the engine at 100 percent 
power as a prerequisite for the first manned orbital flight and a 
subsequent certification of the engine at 109 percent power. This 
two-stage certification strategy represents a change of philosophy 
reached by NASA during the period of the committee’s review. 

It is especially important to understand that while the program 
has been underway for nearly six years and is now within one year of 
the first scheduled manned orbital flight, the development of the 
engine is not as far along as the timetable may suggest. The initia- 
tion of engine development was delayed 9 months for nontechnical 
reason. Thus, in terms of accumulated test experience, the current 
state of development of the space shuttle main engine is relatively 
immature.* The committee finds that the problems now being encountered 
are not alarming but rather typify the early stage of any similar new 
technological development. 

The solution to the problems encountered in the shuttle main 
engine involves the redesign or modification of parts in the rotating 
machinery, with each change affecting the performance of this closely 
coupled engine. While many elements of the engine development point 
to the ultimate success of the program, incorporation of the changes 
and the tests to assure their effectiveness could result in delays. 

The ambitious timetable may have to be extended to avoid a first 
manned orbital flight with a high risk factor. 


*In the development of such a complex system, experience is gained 
slowly at first, but as work proceeds experience accelerates rapidly. 
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In the final analysis, the amount and results of testing performed 
on the ultimate flight-configured engine will determine the 
timing and safety and reliability of the engine for the first manned 
orbital flight • The committee expects that, at the completion of the 
planned testing, adequate data should be available by late summer or 
early fall 1978 to enable NASA to develop a realistic schedule. The 
committee concludes that the appropriate time for NASA to review the 
shuttle flight schedule is when these data are available. The data 
may suggest that a delay is desirable to allow for a more realistic 
rate of testing, to provide leeway for as yet unforseeable changes, to 
incorporate proof-tested parts in the main propulsion test article 
(MPTA) and flight engines and, perhaps most important, to allow 
adequate time to analyze root problems and seek out their solutions 
rather than attempt to cure symptoms. 

In addition to these conclusions, the committee also makes a 
number of recommendations. Some address the need to adhere to 
currently established testing criteria and standards in spite of the 
pressures imposed by an ambitious schedule. The committee recommends 
testing the engine at an added safety margin above the power level of 
the first manned orbital flight and tearing down the engines for 
inspection following at least the first and sixth flight. Additional 
recommendations concerning the need for future design work and 
component testing are also made in this report. 

The balance of this report provides a brief description of the 
shuttle main engine and how it operates, its present status, the com- 
mittee s perception of the critical issues and their consequences, and, 
finally, the conclusions and recommendations. In making this assessment 
of the shuttle main engine program, the committee always recognized two 
basic requirements: First, the need to develop main engines with 

performance levels that will enable the first manned orbital flight to 
be as reliable and safe as America’s earlier manned space flights, and 
then to achieve full power for later flights. Second, the need to 
maintain full power performance in the same engines for at least 
55 missions of each shuttle. 

Based on the experience of the program so far, the committee sees 
no reason to suggest that a safe and reliable main engine cannot be 
developed ultimately for the manned orbital flight tests and the later 
operational flights. 



SPACE SHUTTLE MAIN ENGINE - A BRIEF DESCRIPTION 


The main engine is a machine for producing the thrust necessary to 
launch the space shuttle into a low orbit around the earth. 

The shuttle has three main engines that operate on cryogenic 
liquid propellants — liquid hydrogen, the fuel, and liquid oxygen to 
burn the hydrogen. Each propellant is pumped to a very high pressure 
by two pumps. One is a low-pressure pump that increases the pressure 
several hundred pounds per square inch. Then a high-pressure pump 
increases the hydrogen pressure to 6,200 pounds per square inch and the 
oxygen to 4,600 pounds per square inch. Such pressures are greater 
than those of any previous operational hydrogen/oxygen engines, e.g., 
the RL-10 and J-2, though such pressures have been developed in two 
experimental programs. 

Each of the four pumps (low- and high-pressure hydrogen, low- and 
high-pressure oxygen) is driven by a power source from within the 
engine. The two high-pressure pumps are each powered by a turbine 
mounted on the pump shaft (Figure 1) . The turbine is driven by a hot , 
fuel-rich gas. The gas is produced in a pre-burner where a relatively 
large amount of hydrogen reacts with a small amount of oxygen. The 
product of this combustion is a mixture of hot hydrogen and superheated 
steam. The two low-pressure pumps also are driven by turbines. The 
low-pressure hydrogen pump turbine uses hydrogen gas tapped from else- 
where in the cycle which is described later. The low-pressure oxidizer 
pump, also described later, is driven hydraulically by liquid oxygen 
that is tapped from elsewhere in the cycle. 

The hydrogen flowing from the high-pressure fuel turbopump is an 
effective coolant as well as a source of a high energy. In this engine 
it follows several paths to cool the critical parts where combustion 
occurs or hot gases flow. In its cooling function, the liquid hydrogen 
is heated and vaporized. Most of the gaseous hydrogen is routed to the 
two pre-burners, which serve as gas generators for the turbines that 
drive the high-pressure pumps. A smaller amount of the gaseous 
hydrogen is piped to the turbine that drives the low-pressure hydrogen 
pump. Most of the liquid oxygen is channeled directly to the main 
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Source: Rocketdyne Division Rockwell International 
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combustion chamber. A small amount of the liquid oxygen enters a 
special very high-pressure pump stage mounted on the end of the shaft 
of the high-pressure oxidizer pump. The oxygen flowing at this stage 
is under pressure of 7,650 pounds per square inch, the highest 
pressure in the entire engine. Then the pressurized liquid oxygen is 
fed to the two pre-burners, where part of the hydrogen is burned. The 
prerbumer exhaust is used to drive the high-pressure pump turbines. 

The main event now takes place. The pre-burner exhaust, consisting 
of hydrogen and superheated steam, mixes with the primary high- 
pressure liquid oxygen in the main combustion chamber, where combustion 
takes place at high pressure. The products of combustion, consisting 
mostly of superheated steam, pass through a constriction, the nozzle 
throat, and expand rapidly to a high velocity. Over 1,000 pounds per 
second of combustion products moving at high velocity is the action 
that produces the reaction or thrust for the vehicle. 

While the basic concept is simple — cold liquid hydrogen and 
oxygen coming in and superheated steam propelled out — the various flow 
paths need meticulous control. Such control is provided by valves at 
critical points in the engine. The valves are activated by a special 
purpose digital computer called the engine controller, which converts 
such data as pressure and temperature into position signals. For this 
operation, the controller is a closed loop device, i.e., it is 
self-correcting. The controller also monitors signals from sensors 
mounted in the engine, so that it can quickly shut down the engine 
when a malfunction is detected. 

Another function of the controller is to control carefully the 
engine start-up and shut-down. Without careful control, parts of the 
engine may overheat and even melt. Destructive fires may take place 
by oxygen washing over hot metal surfaces. Prior to start-up all four 
pumps are pre-chilled by liquid propellant circulating through them. 
Sparkplug-like igniters in both pre-burners and the main combustion 
chamber are energized. The main hydrogen valve opens first. As the 
cold hydrogen comes in contact with the engine parts it is gasified. 

The warm hydrogen gas begins to turn the turbines. The oxidizer 
control valves then open in a precise sequence: the igniters initiate 
combustion first in the pre-burners and then in the main combustion 
chamber. The shut-down is essentially the reverse of this process: 
the oxidizer flow is turned off, then the hydrogen flow. The control- 
ler is designed to ensure that all the oxygen is purged from the lines 
downstream of the valves before the hydrogen flow is shut off. This is 
necessary to reduce the possibility of a "hot spike" or high tempera- 
ture surge at shut-down. 

The space shuttle engine has severe requirements of light weight, 
compactness, high absolute thrust, and high thrust per pound of fuel 
burned. Much of the reduction in weight of the main engine is achieved 
by two basic design philosophies. One integrates the system as fully 
as possible. This implies, in part, an exceedingly compact, inter- 
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active arrangement. Compactness provides economies in size and weight. 

It also implies extremely high power densities in the fuel and oxidizer 
pumps. The small separation of hot and cold gases, of fuel gases and 
oxidizer gases, and of liquids and gases gives rise to potential hazards 
that impose extremely stringent demands for reliable construction. 

The other basic design philosophy is to weld as much of the assembly 
as possible. This eliminates heavy flanges and bolts, thus saving sub- 
stantial weight and reducing the size of the assembly. Because welds 
are sometimes a source of incipient cracks, standards of quality control 
and inspection must be very high. Both NASA and Rocketdyne appreciate 
this need and are working to ensure that high standards are met in pro- 
duction. 

This brief description marks the shuttle main engine as a compli- 
cated, high-performance machine made up of a number of interacting 
components and, like its predecessors, designed to provide a high thrust 
per unit of weight. Unlike its predecessors, it is designed to be 
reusable for many flights to orbit. Accordingly, the successful develop- 
ment of the shuttle engine is a prodigious engineering challenge. 



CURRENT STATUS 


On April 4, 1972, Rocketdyne was authorized to oroceed in developing 
the space shuttle main engine — 9 months after it was selected as 
the contractor to develop the engines. Engine system testing began in 
June 1975, nearly 15 months later than the original schedule. Operation 
of the engine at rated power level was first achieved in March 1977 . 

In the course of the development NASA expects to accumulate about 
80,000 seconds (1,333 minutes) of operating experience on the main 
engines. By February 25, 1978, a total of only 11 minutes of operation 
at rated power level had been accomplished, with no operating time at 
full power level. A typical flight will require about 8 minutes of 
engine operation, most of it at close to rated power level for the 
early flight tests and at full power level for the later operational 
missions. The engine's ability to run in demonstration tests at flight 
power level for a total duration of at least five flights (40 minutes) 
without significant malfunctions is one of NASA's essential pre- 
requisites to its use in actual flight. 

Based on the test time accumulated through February 1978 at rated 
power, the engine is still relatively early in its development. It is 
at a point at which running time is accumulating slowly. Development 
programs are designed to uncover problems as rapidly as possible early 
on, and to demonstrate performance and reliability later. As the 
problems are resolved, the rate at which running time is accumulated 
increases rapidly to enable performance and reliability to be demon- 
strated relatively quickly. 

In tests, there have been a number of engine test malfunctions, 
some requiring substantial reconstruction and, therefore, causing 
delays. This is a practical consequence of component proof testing. 

The types of malfunctions have included cracks, fractures, leaks, and 
lack of rigidity. It will not be a simple matter to correct such 
problems, but neither do they involve major redesigns. 

As the testing proceeds and more is learned about the engine, a 
series of changes or modifications will have to be developed to achieve 
the required performance and durability. Many of these changes, but 
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not all, will have to be fully incorporated before the engine can be 
qualified for first flight. Thereafter, a second program of qualifica- 
tion will be required to achieve an engine capable of operating at full 
power, i.e., 109 percent of the rated power level. At present, some 
changes are likely to be required to raise the power level and 
simultaneously increase the life of the engines to the original objec- 
tive of 7% hours. This may upset the overall process of developing the 
engine in view of the extent of the changes that might be necessary. 



TECHNICAL CONCERNS 


Operation at rated power level has revealed a number of problems* Most 
of these difficulties are found in the rotating machinery, i.e., the 
four, high-speed, turbine-driven centrifugal pumps that deliver the 
liquid hydrogen and oxygen propellants to the combustion chamber under 
high pressure. 

Examples of the difficulties are high vibration- induced stresses 
in the high-pressure fuel pump turbine blades, major leakages through 
shaft seals in the high-pressure oxygen pumps, inability of the fuel 
pump to operate at the inlet propellant pressures for which it was 
designed, and low efficiencies. These low efficiencies result in in- 
creased power requirements and thus increased turbine inlet temperatures 
to ensure adequate pump delivery. This occurs because a specified 
engine thrust requires a specified rate of propellant flow. 

The committee notes a significant dichotomy in the state of sub- 
assembly development testing. Such engine components as the combustion 
chamber, the nozzle, the pre-burner, the valves, and the computer- 
controller were tested as components and are performing relatively 
satisfactorily in general. The testing of the high-pressure turbopumps 
as components also had been planned, and a facility had been built at 
Rocketdyne for the purpose. Testing on this rig was initiated on 
May 1, 1975, and concluded on September 12, 1977, with only 161 seconds 
on the oxygen pump system and 111 seconds on the hydrogen pump system. 
Some of the difficulties encountered with the test rig were caused by 
the very high system pressures that required heavy hardware that was 
hard to manage. Thus, long delays resulted when changes were made. 
Rocketdyne and NASA concluded that component testing of the high- 
pressure turbopumps could not be carried out at a rate that would be 
useful in the development program. As a result, NASA and Rocketdyne 
decided to conduct turbopump development tests by running the pumps as 
part of the total engine system. The committee considers this decision 
has great bearing on any examination of the problems in the turbopumps. 
For instance, it precludes testing the high-pressure turbopumps at 
conditions other than the normal operating conditions. The decision 
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also has the effect of preempting the use of hardware for turbopump 
development that could otherwise be used for engine performance 
development testing. 

The lack of an adequate test rig to conduct component tests expe- 
ditiously outside the engine appears to be the primary reason that the 
turbopump problems were not discovered before last s umm er, during the 
engine tests at the rated power level. 

NASA and Rocketdyne hold that the engine tests at rated power 
level have provided the data necessary to identify any deficiencies in 
the engine and the high-pressure turbopumps, and the data necessary to 
formulate corrective actions. Insofar as the committee is aware, 
however, no rocket engine using turbopumps has ever been produced 
without extensive development testing of the turbopumps first as 
components. 

In this connection, a facility for component testing of high- 
pressure turbopump systems was developed for the XLR-129 program. 

While an adequate turbopump test rig cannot be made available to 
contribute to the development of the main engine for the first flight, 
past experience suggests that such a test rig could be very useful in 
the long run for identifying and solving problems associated with 
durability and reliability. Accordingly, NASA and Rocketdyne may want 
to explore the most effective way to acquire an operating component 
test rig for the rotating machinery. 

The committee considers the following to be of primary technical 
concern: 

o The high-pressure oxidizer turbopump is critical to the 
performance and safety of the main engine. While the 
committee recognizes the design changes being made, it 
notes a considerable number of these are yet to be 
verified. Nevertheless, the complexity of the design, 
the relative flexibility of the shaft and housing, the 
complicated load paths, the extremely high performance 
demands, and the planned multiple reuse suggest that a 
back-up shaft and housing design be initiated. While 
a long lead-time is involved, a parallel development 
seems to be in order for this key assembly. 

o The heat exchanger downstream from the oxidizer turbo- 
pump pre-burner is an extremely complicated welded 
assembly. It is located in a position where inspection 
is difficult. While no recent incidents have been 
attributed to heat exchanger failures, the committee is 
concerned that a failure of the heat exchanger could be 
catastrophic. Therefore, this item warrants continued 
management attention. 



13 


o The preliminary flight certification of the engine re- 
quires the development of a specific set of hardware that 
will meet the test requirements. Because the main engine 
is a closed cycle machine in which the performance of 
each individual component such as a valve, say, or a 
turbine- driven pump or a heat exchanger affects all the 
other components, it is essential that the number of 
changes between successive tests be kept as low as 
possible, particularly when the performance of the 
component is involved. 

o Three failures in the high-pressure fuel turbopumps have 
been attributed to high cycle fatigue in the turbine 
blades. The first two incidents (which occurred at 
accumulated times of 313 seconds and 2,973 seconds) were 
confirmed by fractographic analysis. The third failure 
is inferred because the turbine was destroyed by fire 
during testing. While there is general agreement among 
the experts that the material used for fabricating the 
blades is suitable, the committee considers that a more 
complete characterization of the material is needed. 

The problem of high cycle fatigue is common in turbine 
development, and the committee is confident this 
problem will be solved. While the turbine blade 
problem* has received considerable attention and 
although it may require a year or so to provide a 
permanent solution, the committee finds the difficulties 
to be characteristic of the kinds of problems encoun- 
tered in the development of any new turbine system. 

Not unexpectedly, many components are being redesigned or modi- 
fied to a greater or lesser extent. For instance, all four turbopumps 
(low-pressure and high-pressure, fuel, and oxidizer) are being altered, 
sometimes by several changes simultaneously. One indication of the 
present state of the engine development is that the turbine inlet 
temperature of the high-pressure fuel turbopump is running some 450° F 
above the design value of 1,271° F at 100 percent power level. The 
program developed to reduce the temperature is outlined in Figure 2. 

It is not now certain that each of the changes will produce the 
predicted temperature reduction. It is certain, however, that each of 
these changes will affect the performance of the rest of the engine. 

In effect, a whole succession of configuration changes is under- 
going tests. Because changes are being made in several other parts of 
the engine as well, it appears likely that the development will take 
more time than planned. This, too, is to be expected in any major new 
development. In fact, the more advanced the design, the longer the 


*See Appendix B for more details 
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development process is likely to take. The time required to correct 
test-induced failures ranges from a few weeks for simple modifications 
to over a year for more complicated redesigns. Note that some of these 
redesigned parts may not be needed for the first manned orbital flight. 
Full power operations, however, require such modifications. 

Fortunately, many elements of the engine program give evidence that the 
desired performance, durability, and safety can be achieved. Thus the 
committee has no doubt about the successful final outcome. 



SCHEDULE CONCERNS 


To bring together all the necessary components for a safe, reliable, 
and reusable engine without undue and costly delays to the scheduled 
first manned orbital flight requires managerial skills of the first 
order. Such skills are particularly necessary for a program in which 
decisions are made seven or eight years before the main event. In 
this case, the schedule needs to possess some flexibility. Slippages 
of a month or two in a program of 100 months, involving the development 
of a new, technically challenging system, do not represent a serious 
defect. Indeed, a 10 percent to 12 percent extension in schedule 
should be regarded as normal and not an anomaly. 

However, as critical milestones approach, intense pressures to 
meet the schedule are apt to develop. Frequently, this involves 
considerable parallel effort and overtime work. So long as everything 
goes reasonably well, this causes no untoward problems. But when 
troubles arise, the potential increases for new, unforeseen difficul- 
ties, both technical and managerial. The temptation exists to cut 
corners, omitting tests of components for instance, to keep to the 
schedule. Moreover, human fatigue or stress can lead to mistakes in 
judgment. 

In such circumstances, increased demands are placed on management 
to know when to hold to the original schedule and when to allow a 
slippage. Indeed, a first flight may be delayed and, yet, because of 
the greater reliability attained through improvements and modifications, 
the overall program can be benefitted, and the early delay can be made 
up so that later flights are on schedule. 

In the case of the space shuttle main engine, the authorization 
was delayed by 9 months. This imposed great pressure on the schedule. 

To deal with this, NASA and Rocketdyne have laid out an ambitious time- 
table for incorporating and testing newly designed parts. The rate of 
accumulation of engine operating time shown in Figure 3 is clearly 
based on meeting it. Notwithstanding, the committee considers such an 
optimistic schedule is not likely to be realized in practice because 
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of the small likelihood of success of all the modifications currently 
in progress. 

The completion of tests and evaluation of performance of modified 
components during the next 5 to 7 months should help substantially in 
determining the time that will be required to obtain a flight- 
certified engine. While the committee recognizes that a successful 
engine can be developed without component testing of the high-pressure 
turbopumps, in the absence of any past experience with such a program 
there is inadeqpate data to make a reliable prediction of the time 
required to accomplish the development. 

The committee suggests that NASA will need to examine the status 
of the engine development in late summer, early fall, or whenever data 
sufficient to assess the engine status becomes available, in order to 
prepare a precise schedule. The data may show, for example, that the 
first manned orbital flight is possible within the current schedule. 

On the other hand, it may show that the optimism is not warranted. 
Moreover, the data may suggest that a delay is desirable to allow 
for a realistic rate of testing, provide leeway for further changes, 
incorporate proof-tested parts in the main propulsion test article and 
flight engines and, most importantly, allow time to analyze problems 
and proposed solutions adequately. In the last respect, the committee 
is concerned that the current schedule is so compressed it generates 
an atmosphere that seems to inhibit realistic evaluations of the 
problems encountered so far. 



SAFETY AND RELIABILITY 


Safety must always take precedence over scheduling concerns. Because no 
flight test of the space shuttle main engine is planned prior to the 
first manned orbital flight, confidence in the safety and reliability of 
the engines in manned flight must be based upon: 

o Safety and reliability designed into the engine 

o Testing of flight-configured engines 

o Quality control and testing of the three engines 

when mounted in the orbiter for the first flight. 

It is important that the term "flight-configured engine" be well 
understood. "Configuration" means identification of all the parts mak- 
ing up an engine. As in any engine development, design changes are made 
in response to problems as they are uncovered. Thus, early in the de- 
velopment program, the configuration is in a state of change. While 
total test time in the overall program is an important measure of the 
maturity of its development, the amount of testing performed on the 
flight configuration is the single most important parameter in consider- 
ing the safety and reliability of the first flight. Figure 4 shows the 
improvement in the operating conditions expected from incorporation of 
improved hardware. When this chart was prepared, the contractor had 
assumed all changes would be fully effective. 

Evaluating the "testing of flight-configured engines," therefore, 
involves a verification of the extent of engine maturity. Rocketdyne 
plans to achieve approximately 40,000 seconds (11 hours) of firing time 
on the flight-configured engine (Figure 5) before the first manned or- 
bital flight (FMOF). To accomplish this, the committee suggests that 
additional hardware will be required. What is more, additional techni- 
cal problems are likely to arise in the course of testing. 

NASA has divided the preliminary flight certification into two 
phases. The first phase, labelled PFC-FM0F s (Preliminary Flight 
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Certification-First Manned Orbital Flight), will achieve the following 
milestones on a single, flight-configured engine: 

o 1 hour total time 

o 10 starts 

o 50 percent of the firing time at the 109 percent 
rated-power level with inlet conditions the 
same as expected in first manned orbital flight. 

(NASA is considering reducing this power level 
to 100 percent.) 

The current NASA scheduling for the shuttle main engine calls for 
complete preliminary flight certification (PFC in Figure 4) to be com- 
pleted before first flight. This complete preliminary flight certifi- 
cation is to be performed on the same engine used in the first phase, 
or PFC-FMOF, described above. In the second phase, total duration is 
to be extended to 9,000 seconds (2.5 hours), and the number of starts 
extended to 25. This test duration is more than 12 times a single 
flight duration > which is an appropriate margin from high-cycle 
fat igue cons iderat ions . 

The committee was informed that NASA is giving serious considera- 
tion to limiting engine power to 100 percent rated power level for the 
first manned orbital flight. Data were presented indicating that the 
mission objectives for this flight, including abort modes, can be 
achieved at 100 percent rated power level or less. The committee con- 
siders this reasonable, but finds it important to demonstrate engine 
operation at a power level in excess of the mission requirement. The ' 
committee suggests that such a safety margin be set at 2 percent (102 
percent of whatever power level is selected for the mission) . 

In addition to the development testing and the preliminary flight 
certification of the single engine, NASA plans call for tests of the 
main propulsion test article (MPTA) , i.e., the cluster of three flight- 
configured engines fed from a flight-configured main tank. These tests 
are indicated in Figure 4 as tests 8 through 13. The committee is con- 
cerned that the planned testing may be reduced to maintain the schedule. 

The last important confidence factor, quality control and testing 
of the actual flight engines, involves management procedures to ensure 
that the actual flight engines are identical in every essential respect 
to those successfully tested during the development, the preliminary 
flight certification for first manned orbital flight, and the tests of 
the main propulsion test article. NASA and Rocketdyne have such pro- 
cedures, which appear adequate^ to the committee. Acceptance testing on 
the actual flight engines involves three starts — two at short duration 
and one at full flight duration. In addition, the actual flight engines 
for the first manned orbital flight will be tested for 20 seconds on the 
launch pad in a "hold-down" test. 



If the three safety and reliability considerations are handled 
successfully, as described above, the committee is confident that the 
main engines will perform safely in the first manned orbital flight. 

By this, the committee means that the engine must perform not only with- 
out failure, but also without indication of incipient failure, appear- 
ance of distress abnormal wear conditions, or borderline values of 
measured parameters, and so forth. This confidence is also based upon 
the assumption that the ground testing of flight-configured engines will 
provide for a reasonable test time at a power (thrust) level 2 percent 
greater than the power level to be used in first manned orbital flight. 

With respect to subsequent flights in the shuttle program, NASA 
plans to use the first set of three engines on the first six manned 
orbital flights. No disassembly of the engines after flight is cur- 
rently planned, only horoscope and visual inspection. The committee 
recommends that this inspection be expanded to include engine "tear- 
down" and inspection after the first and sixth flights. If the inspec- 
tion following first flight reveals no signs of distress and if the 
engines are performing properly, horoscope and visual inspection after 
the next four flights are considered adequate. 

The committee did not address in detail the approach and schedule 
for final flight certification, i.e., assurance of the safety and re- 
liability of the engines throughout their 55 missions. Improvements 
in pump efficiency and in main combustion chamber cooling are planned 
to reduce the fuel turbine inlet temperature to the design level. Most 
of these changes, listed in Figure 2, are still in the design or fabri- 
cation stage, leaving proof of capability still to be demonstrated. 
Reduction of the inlet temperature is essential to the attainment of 
satisfactory turbine life over the course of the manned missions. Each 
actual improvement realized in the turbine inlet temperature should be 
closely monitored and alternative approaches should be developed for any 
change that falls short of the expected temperature reduction. Only 
when the engine performance level has stabilized can the final assess- 
ment of engine life be completely meaningful. Additional time and 
additional test hardware are likely to be required to reach final 
flight certification. 



RECOMMENDATIONS 


o It is too early to predict the exact timing of the first 
manned orbital flight* The committee expects adequate 
data will be available by late summer or early fall of 
1978 to plan the first flight schedule more realistically. 
Because of the number of critical milestones yet to be 
achieved, the committee recommends that the schedule be 
reviewed at that time. 

o The committee recommends that Rocketdyne acquire an 
additional engine and critical parts to accomplish the 
required testing in this period. This hardware can be 
diverted from the production program into the R&D pro- 
gram, and replaced in the production program at a later 
date. 

o The committee recommends the initiation of an alternate 
design of a new high-pressure oxygen turbopurap shaft 
and housing. 

o The committee recommends a review of the decision to 
perform turbopump development tests by running the pumps 
as part of the engine system to examine alternative 
options for the long term. NASA and Rocketdyne should 
explore means of acquiring and operating a component- 
development test rig for the rotating machinery. Among 
the options are: modification of Rocketdyne f s existing 
test rig for the shuttle main engine; use of the compo- 
nent-development test rig for the XLR-129 experimental 
program if it is intact and available; design and con- 
struction of a new test rig utilizing the engineering 
experience involved in the development and use of the 
^^■"^29 facility. This kind of equipment is likely to 
prove invaluable throughout the life of the space shuttle 
transportation system 0 
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To minimize future delays in the schedule, NASA and 
the contractor should allow adequate time to analyze 
root problems and seek out their solutions rather 
than selecting technical "fixes" to cure symptoms. 

The minimum preliminary flight certification require- 
ment before first flight, as currently planned by NASA 
should not be compromised and should be strengthened 
by a requirement for tests at a power level in excess 
of that required for flight, as follows: 

1. Successful completion of the main propulsion 
test article program on flight configuration 
engines with at least two uninterrupted full 
duration runs at 102 percent of first manned 
orbital flight power level. 

2. Successful completion of at least 10 starts 
and 3,000 seconds of operation on a single 
engine of flight configuration. At least 25 
percent of this time should be at 102 percent 
of first manned orbital flight power. 

A complete tear-down inspection of the main engine 
should be conducted after the first and sixth flights. 
If there are no signs of distress and if the engines 
are performing properly after the first flight, a 
horoscope and visual inspection should be sufficient 
after each of the next four flights. 

While the heat exchanger has encountered no 
problems recently, the committee urges that 
it should continue to receive management's attention. 
The heat exchanger system poses a potential threat to 
the total shuttle system. However, the changes 
required for a redundant heat exchanger to eliminate 
this single point threat of failure seem to be so ex- 
tensive that provision for redundancy is impractical. 
Nevertheless, the committee recommends that an alter- 
nate design and development should be explored to 
relocate or reconfigure the heat exchanger system. 

The next step in the engine development should be to 
Increase the power level to a full 109 percent. 



APPENDIX A 

TURBO MACHINERY DEVELOPMENT CONCEPTS 
by 

Lee F. Webster 


Past Approach 

In the past, the U.S. rocket industry has employed component test facil- 
ities for the development of rocket engine pumps and turbines. Such 
facilities are designed to subject the applicable hardware to the total 
range of operating conditions required to prove that these components 
have achieved the design performance and reasonable operability before 
risking testing of the complete engine system. Use of such facilities 
allowed detailed measurement of performance, stresses and temperatures 
without restrictions imposed by the limitations of other engine system 
components. Thus the testing could be designed to define the strong and 
weak characteristics of the component, as well as to assess the margin 
for error available when the component was integrated into the system. 
Generally, this approach minimized costs incurred from damage to other 
engine system parts if failure occurred. 

With the growing complexity of rocket systems, component test 
facilities have also become more complex and more expensive, often be- 
coming developmental efforts in themselves. Lead times required to 
design, procure and "debug" such facilities are often measured in years 
and thus become a major item in planning for the acquisition of a rocket 
engine. 

Space Shuttle Main Engine Approach 

Early Space Shuttle Main Engine program planning was predicated on 
the construction and use of a component test facility. However, efforts 
to use the facility proved to be difficult, expensive and not very fruit- 
ful in terms of acquiring useful turbo machinery information. Figure 
A-l summarizes the accomplishments in terms of the test and running time 
over a 27-month time. Normally, such testing for past rocket develop- 
ments would have accumulated at least 10 times more testing. Late in 
the past year, this approach was abandoned. Future turbo machinery 
testing is to be accomplished only on engine test stands using the in- 
tegrated engine assembly as the test fixture. 
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SUMMARY OF TESTING AT COCA-1 FACILITY 
Initiated May 1, 1975 • Concluded Sept. 12, 1977 



Tests 

Sec 

Assemblies Tested 

COCA 1A 
LPOTP 

15 

706 

4 

LPOTP-HPOTP 

24 

161 

3 

COCA IB 

LPFTP 

47 

2192 

6 

LPFTP-HPFTP 

27 

111 

6 


Source: Rocketdyne Division Rockwell International 


Figure A-l 


Results 


Because of the lack of a successful turbo machinery test facility, 
characterization and verification of the high pressure pump designs is a 
pacing item in the development schedule. Some problems have been iden- 
tified during engine testing and efforts for their solution are. now 
underway, as shown in Figures A-2 and A-3. Some of these problems must 
be solved before the hardware to be used for the first manned orbital 
flight can be tested on the engine. Because of the interaction of the 
various components of the engine and the multiplicity of modified de- 
signs yet to be proven, the committee judges that development testing 
could take longer than the current schedule allows. Further no apparent 
adjustment to work plans on the test stands or provision of additional 
hardware to accommodate the shift of turbo machinery development testing 
to the complete engine was detected. 

Analysis 

With current developmental testing behind schedule and many re- 
designs still to be added to the system and proven, it is prudent to 
focus on the acquisition of an engine configuration suitable for early 
flights, thus minimizing potential shuttle program delays. It is time 
to consider the establishment of an interim engine developmental goal 
(see Figure A-4) (Block I design) with performance and life limited to 
that adequate for safe early flights. Planning for the acquisition of 
a final (Block II) design to attain the final performance and life 
characteristics should begin immediately. Such thinking fits into cur- 
rent schedule projections by NASA and the contractor as shown by Figure 
A-4 on which the committee has added possible Block I and Block II 
breakpoints. 
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SSME CONFIGURATION BASELINE 

MPTA (1-4) 

• HPOTP (HIGH PRESSURE OXYGEN TURBOPUMP) 

• Improved Balance-Reduced Synchronous Radial Loads 

• Increased Bearing Preload 

• Improved Turbine Bearing Coolant Flow 

• HPFTP (HIGH PRESSURE FUEL TURBOPUMP) 

• Existing Heavy Turbine Blade Dampers 

• Existing Turbine Platform Seals 

• Turbine Blade Damper Side Platform Coating 

• Bradelloy T urbine Tip Seal 

• LOW PRESSURE LIQUID OXYGEN DUCT 

• Existing Design 

• Life Limited-2780 Seconds 

• Limited-2 0 Gimballing @ 90% 

Source: Rocketdyne Division Rockwell International 


Figure A- 2 
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SSME CONFIGURATION CHANGES-STEP 1 

MPTA (5-7) 

• HP FTP 

• Machined Damper Precision Fit-Up 

• Faired Turbine Struts 

• Six Segment ReneVNickel Turbine Tip Seal 

• Modified Leading Edge Turbine Platform Seals 

• Damper Contact Platform Coating Removed 

• LOX PRESSURE LOX DUCT 

• Interim Design Flex Joints 

• Life Limited-4500 Seconds 

• Full Gimballing 

• FUEL TURBINE TEMPERATURE REDUCTION 

• Rebalance Preburner Injector Resistances— 70° 
Source: Rocketdyne Division Rockwell International 


Figure A- 3 



SSME CONFIGURATION VERIFICATION 
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Source: Rocketdyne Division Rockwell International 



APPENDIX B 
NOTES ON 

HIGH-PRESSURE FUEL TURBOPUMP TURBINE BLADE FAILURES 

By 

William Rostoker 


During operation at rated power level of the space shuttle main engine 
a problem in the high-pressure fuel turbopump (HPFTP) became apparent. 
Two pump failures are clearly due to failure of one or two turbine 
blades. A third failure is attributed to a blade failure, but no 
direct evidence is available. Rather, the evidence is a loss of 
turbine power. The status of each blade failure incident is tabulated 
below. 


1. 

T/P 

0202 

R1 

8 

starts 

& stops 330 sec 

original design 

2. 

TEST 

95 


38 

11 

" 2,976 sec 

coated blades 

3. 

T/P 

0202 

R4 

21 


4,325 (A) 

coated 





11 


2,356 (B) 

II 


NOTE: 


A 

47 

blades 

with this usage 





B 

16 

tl 

t! II II 



In the first case the failure was attributed to damper lock-up. Calcu- 
lation suggests the mean stress to be in the neighborhood of 55,000 
pounds per square inch in this condition. Two blades were cracked; no 
separation occurred. 

In the second case damper lock-up was also alleged to be the cause. 
The physical reason for the second failure is different from the first. 

In the third case the pump was destroyed so no detailed evidence 
existed. 

Blade material: MAR-M-246, hafnium modified, directionally 
solidified (DS) . Operating temperature: 1600-1700° F gas temperature 

with temperature spikes over 2000° F. 

Environment: hydrogen and steam, with blades subject to steady 

stress (centrifugal) plus vibratory stresses due to turbulence 
associated with struts supporting the main shaft bearing and the inlet 
guide vanes. The vibratory component of stress is to be reduced by a 
damper device between the turbine blades. The blades are subject to 
high-frequency fluctuating stresses superimposed on a large static 
stress level leading to a high cycle fatigue possibility. Blades also 
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are subject to a hydrogen quench at the end of a burn leading to 
thermal fatigue crack possibilities 

Three sets of turbine blade failures: 

1. T/P 0202 R1 

uncoated blades, original turbine design, 330 sec. total 
run involving 8 starts and stops. Blade platform and 
tree root gold-plated to reduce H 2 absorption. Damper 
surfaces Ni plated. 

Two blades discovered with cracks but no severence - one 
crack started at the leading edge, near the base of air- 
foil. Another crack started at the trailing edge, 
higher up from the base. Cracks ran across the grain. 

Reputed reason for cracking: damping eliminated because 
Au-Ni fused the blades together. 

2. Test 95 

Coated blades (NiCrAlY (0.003") + Zr02 (0.004") 

No Au coating. Ni coating on damper surfaces. 2976 sec. 
total run - 38 starts and stops. 

One fractured blade - crack started at leading edge near 
base of airfoil. 

One cracked blade (3 blades away) at same location. 

Reputed reason for cracking: temperature spike over 

2100° F - 1 sec allowed softened Ni coat to extrude up 
into space between damper and blade causing seizing and 
elimination of damper action. 

3. T/P 0202 R4 

Test 147, coated blades, no Au, no Ni coatings 

Mix of blades: 47 - with 4,325 sec life (21 starts & stops) 

16 - with 2,356 sec life (11 starts & stops) 
The replacement of 16 blades because of thermal fatigue 
cracks in the platform although no failures had occurred 
there. Pump lost power, ceased to pump H 2 although 02 flow 
continued. Hot turbine + O 2 led to catastrophic oxidation 
and melting. Blade evidences obliterated. No way of 
knowing if a blade fracture began the events. 

Fracture and Crack Appearances 

Initiation (Stage I) flat, cleavage like, transgranular basically 
same appearance as in laboratory high cycle fatigue tests. Hence 
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deduced as high cycle fatigue fracture. Thermal fatigue does not seem 
to be an initiating factor. Fatigue cracks do appear on the platform 
but not on the leading or trailing edges. 

Fatigue cracks progress nearly halfway across the blade before 
fast fracture takes over. 

Crack or Fracture Frequency 

1. T/P 0202 R1 

2 cracked blades. 61 uncracked blades in first stage 
100% inspection showed no visible cracks in the 61. 

2. Test 95 

2 cracked blades, 61 uncracked blades in first stage (100% 
inspection) at 639 sec (13 starts and stops) full inspection 
showed no cracks in any blade. 

3. T/P 0202 R4 

At 2,000 sec (2,356 sec before failure) all 63 blades in the 
first stage were crack-free in airfoil, although there were 
thermal fatigue cracks in the platform. 

Discussion 

There have never been more than 2 cracked blades among the 63 in 
the first stage. There are two possible interpretations that can be 
inferred: 


a. Two blades out of 63 contained microscopic crack-like 
flaws that escaped detection. Quality control by the 
supplier requires flaw detection by dye penetrant 
(0.010 in resolution). X-ray radiographic and visual. 

These are not likely to detect microscopic, especial- 
ly sub-surface, flaws. 

b. Two blades failed out of 63 represent the normal low 
probability of early failure in a distribution of 
failure lives that spans over a ten-fold range. 

Actually a. and b. are the same. The random occurrence of micro- 
scopic flaws not detectable by present art provides for the wide range 
of fatigue levels of normally identical products. At the time of early 
failure, possible cracks in the remainder could still be too small to 
be resolvable. 

Rocketdyne staff are inclined to accept the range of high cycle 
fatigue resistance as state-of-the-art for turbine blades. Elimina- 
tion of such microscopic flaws as shrinkage porosity, non-metallic 
inclusions and carbide networks are not expected to be feasible or 
necessary. They expect to eliminate early fractures by reducing the 
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fluctuating stress component by redesigning the struts in the hot gas 
inlet and by redesigning the dampers between blades to more efficiently 
reduce fluctuating stresses. 

Note that no blade failures (fracture or cracking) have been 
observed in the second stage although the static (centrifugal) stresses 
are the same. However, the gas temperature is lower but the primary 
1 reputed difference is that the dynamic stress components are much less 

. than in the first stage. 

An important but lost study opportunity would have been to analyze^ 
A experimentally, the reduced fatigue life of the surviving, uncracked 

blades. This would have demonstrated whether sub-microscopic cracks 
had developed but were beyond resolution or that the blades were not of 
reduced fatigue life — in which case the two failed blades (in each 
case) must have been flawed. 

Conclusions 

1. Coatings are not an issue in blade cracking. 

2. Thermal fatigue is not an issue in blade cracking. 

3. The DS MAR-M-246 hafnium-modified material is probably as 
good a blade alloy as laboratory testing will indicate. 

4. The quality of casting and the sensitivity of quality 
control is limited so that high cycle fatigue performance 
has a large range, i.e., fatigue life at a given stress 
fluctuation can vary from shortest to longest by a 
factor of ten. This statement represents the state-of- 
the-art . 

5. The turbulence-generated fluctuating stress component 
should be reduced by modified strut design, if possible. 

6. Re-designing the damper will probably reduce the fluctu- 
ating stress component on the leading edge as well as 
the trailing edge of the airfoil, but this cannot be 
verified until full testing of a single engine is 
completed. 

7. Unless there is a new approach to screening and rejecting 
potentially low performance blades (high cycle fatigue) 
and unless the cycle service stresses can be reduced, the 

. expectation of reducing fatigue failures to zero for the 

life of the turbine is not optimistic. The evidence is 
not adequate to determine any metallurgical hypothesis 
for failure. It could be due to a non-detectable flaw 
that is to be expected in the tail of the distributor 
v functions or it could be due to a flaw that is a result 

of lack of procedural control. The characterizations 
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of the material, particularly the spread in the fatigue 
behavior, are incomplete and should be completed. 

The blades are less likely to be a problem if the 
temperature is reduced 350-500° F . , as proposed by the 
contractor. 



